CVE-2016-6620

CVE-2016-6620 affects phpMyAdmin: the vulnerability arises when data is passed to unserialize() without validating serialized data, enabling potential code execution through object instantiation/autoloading. Affected versions are all 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0...

CVE-2016-6623

CVE-2016-6623 affects phpMyAdmin: an authorized user can cause a denial-of-service on the server by passing large values to a loop. Affected versions include all 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. The issue is a DoS condition due to looping with large inputs; n...

CVE-2016-6624

CVE-2016-6624 affects phpMyAdmin: IPv6 in proxy setups can bypass IP-based authentication when the proxy is allowed but the client is not. Affected versions are 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. The vulnerability allows the attacking host to connect despite IP...

CVE-2016-6626

CVE-2016-6626 affects phpMyAdmin. An attacker could redirect a user to a malicious web page. Affected versions include all 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. The issue is a web redirect flaw within phpMyAdmin that could be triggered by a crafted link after auth...

CVE-2016-6627

CVE-2016-6627 affects phpMyAdmin, exposing host location via the file url.php. All 4.6.x versions before 4.6.4, all 4.4.x before 4.4.15.8, and all 4.0.x before 4.0.10.17 are vulnerable. The issue is a information disclosure flaw in how url.php reveals the phpMyAdmin host, enabling an attacker to ...

CVE-2016-6628

The CVE-2016-6628 issue affects phpMyAdmin and allows an attacker to cause a user to download a specially crafted SVG file. Affected branches include 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. Connected advisories and trackers confirm the vulnerability exists in phpMyA...

CVE-2016-6629

CVE-2016-6629 affects phpMyAdmin through the configuration directive $cfg['ArbitraryServerRegexp'], enabling an attacker to reuse certain cookie values to bypass server restrictions defined by ArbitraryServerRegexp. Affected are 4.6.x versions before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before...

CVE-2016-6630

CVE-2016-6630 describes a DoS in phpMyAdmin triggered by an authenticated user who enters a very long password in the Change password dialog. Affected are phpMyAdmin 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. Connected documents corroborate the vulnerability in multipl...

CVE-2016-6631

CVE-2016-6631 describes a remote code execution issue in phpMyAdmin when run as CGI. Under certain server configurations, a user can pass a query string that is executed as a command-line argument by the file generator_plugin.sh, enabling RCE on the server. Affected versions are all 4.6.x before ...

CVE-2016-6632

CVE-2016-6632 affects phpMyAdmin: under certain conditions, temporary files may not be deleted during ESRI-file imports. Affected versions include all 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. Remediation guidance from connected documents: Debian LTS fixes apply to ph...

CVE-2016-6633

CVE-2016-6633 affects phpMyAdmin: remote code execution possible on PHP installations using the dbase extension. Affected: phpMyAdmin 4.0.x before 4.0.10.17, 4.4.x before 4.4.15.8, and 4.6.x before 4.6.4. Connected sources confirm this vulnerability and document remediation guidance. Impact is re...

CVE-2016-9848

CVE-2016-9848 affects phpMyAdmin: the phpinfo() output reveals PHP info including the values of HttpOnly cookies. Affected versions are all 4.6.x before 4.6.5, all 4.4.x before 4.4.15.9, and all 4.0.x before 4.0.10.18. The issue is due to exposure of cookie values in phpinfo output. Mitigation: u...

CVE-2016-9850

CVE-2016-9850 affects phpMyAdmin; root cause is non-constant execution time in username matching for allow/deny rules, which may cause wrong matches and exposure of the username in rules. Affected versions: phpMyAdmin 4.6.x before 4.6.5, 4.4.x before 4.4.15.9, and 4.0.x before 4.0.10.18. Impact i...

CVE-2016-9851

CVE-2016-9851 (phpMyAdmin) : A vulnerability allows bypass of the logout timeout via a crafted request parameter. Affected are all 4.6.x versions prior to 4.6.5 and 4.4.x versions prior to 4.4.15.9. The issue is documented in the initial CVE entry, with CVSS metrics indicating a low to medium imp...

CVE-2016-9853

CVE-2016-9853 affects phpMyAdmin; a fopen wrapper-related issue can cause PHP error messages to disclose the full phpMyAdmin directory path, especially during export timeout. Affected: phpMyAdmin 4.6.x before 4.6.5 and 4.4.x before 4.4.15.9. Remediation: upgrade to a fixed release (Gentoo GLSA re...

CVE-2016-9854

Summary (CVE-2016-9854) : A path disclosure issue in phpMyAdmin arises when triggering certain scripts; an error message can reveal the full path to the phpMyAdmin installation, and during export time these paths are written into the export file. Affected versions are all 4.6.x before 4.6.5 and 4...

CVE-2016-9855

CVE-2016-9855 affects phpMyAdmin: PMA_shutdownDuringExport allows error output revealing the full phpMyAdmin directory path when an export times out. Affected: phpMyAdmin 4.6.x prior to 4.6.5 and 4.4.x prior to 4.4.15.9. This issue arises from triggering PHP errors via certain script calls, with ...

CVE-2016-9856

CVE-2016-9856 is a PHPMyAdmin XSS issue tied to an earlier fix for CVE-2016-2559 (PMASA-2016-10). The vulnerability affects 4.6.x (before 4.6.5), 4.4.x (before 4.4.15.9), and 4.0.x (before 4.0.10.18) due to reuse of a hash in a race condition; remediation is to upgrade to fixed versions (e.g., 4....

CVE-2016-9857

phpMyAdmin has a cross-site scripting (XSS) vulnerability (CVE-2016-9857) caused by a weakness in a JavaScript processing regex. Affected releases: 4.6.x before 4.6.5, 4.4.x before 4.4.15.9, and 4.0.x before 4.0.10.18. Remediation: upgrade to a fixed version (e.g., 4.6.5.1 or later). If upgrading...

CVE-2016-9860

CVE-2016-9860 describes a DoS in phpMyAdmin when $cfg['AllowArbitraryServer']=true. Affected are phpMyAdmin 4.6.x before 4.6.5, 4.4.x before 4.4.15.9, and 4.0.x before 4.0.10.18. Root cause is unauthenticated DoS via arbitrary servers; impact is availability. Remediation per connected sources: up...